In conventional flow monitoring systems, the counter values of an entire flow table are transferred from a network interface controller to a memory of a trusted host. The trusted host, using trusted software such as a hypervisor or OS kernel, then reviews and scans the counter values of the entire flow table. Checking the counter values of an entire flow table (e.g. 16K entries) creates a lot of overhead and becomes a resource expensive operation. Thus, there is a need in the art to reduce the DMA, CPU, and memory system overheads associated with reviewing the counter values.